diff options
| author | Michael Niedermayer <michael@niedermayer.cc> | 2019-08-29 18:59:10 +0200 |
|---|---|---|
| committer | Michael Niedermayer <michael@niedermayer.cc> | 2019-09-16 00:53:18 +0200 |
| commit | 9fac243744c6c0ce2a2cf23550bc48b736661379 (patch) | |
| tree | 4e5e11e87773e74eb29b9432b2e8d100c19b8372 | |
| parent | 305f6dbb060f490e5de0eed84e3149fcccc0fd91 (diff) | |
| download | ffmpeg-9fac243744c6c0ce2a2cf23550bc48b736661379.tar.gz | |
avcodec/cfhd: Check that cropped size is smaller than full
Fixes: signed integer overflow: 57342 * 120830 cannot be represented in type 'int'
Fixes: 16426/clusterfuzz-testcase-minimized-ffmpeg_AV_CODEC_ID_CFHD_fuzzer-5758744817827840
Found-by: continuous fuzzing process https://github.com/google/oss-fuzz/tree/master/projects/ffmpeg
| -rw-r--r-- | libavcodec/cfhd.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/libavcodec/cfhd.c b/libavcodec/cfhd.c index 27eed415d1..b4d6b25cbc 100644 --- a/libavcodec/cfhd.c +++ b/libavcodec/cfhd.c @@ -625,8 +625,12 @@ static int cfhd_decode(AVCodecContext *avctx, void *data, int *got_frame, ret = ff_set_dimensions(avctx, s->coded_width, s->coded_height); if (ret < 0) return ret; - if (s->cropped_height) - avctx->height = s->cropped_height << (avctx->pix_fmt == AV_PIX_FMT_BAYER_RGGB16); + if (s->cropped_height) { + unsigned height = s->cropped_height << (avctx->pix_fmt == AV_PIX_FMT_BAYER_RGGB16); + if (avctx->height < height) + return AVERROR_INVALIDDATA; + avctx->height = height; + } frame.f->width = frame.f->height = 0; |